Software Engineering Process - II 3.1 Unit 3: Risk Management Software Engineering Process - II

Software Engineering Process - II 3.2  What are your expectations from this unit? Before You Begin…

Software Engineering Process - II 3.3 Unit Objectives  Describe the elements of risk management.  Identify steps of risk management.  Explain identification of risks.  Describe and perform risk analysis.  Identify risk treatment methods to reduce the probability and impact of risks.  Estimate risk impacts and avoidance costs.  Identify the tasks involved in risk monitoring and controlling.  Create a risk management plan.

Software Engineering Process - II 3.4 What is Risk  Risk is present in some form in all human activities.  Risk:  Involves uncertainty, is expressed as probability  Includes a loss  Is manageable by applying some human action to change its form and degree  Risk management deals with potential problems unique to a specific software project.

Software Engineering Process - II 3.5 Elements of Risk Management  Risk management comprises following processes used to control risks:  Risk identification: Identify risks and their impacts.  Risk analysis: Define options for dealing with these risks.  Risk planning: Handle the risks if they become problems.  Risk monitoring: Assess the risk impact.

Software Engineering Process - II 3.6 Risk Management Process

Software Engineering Process - II 3.7 Project Management - Some Common Risks  Late requirement changes  Error-prone products  Client not able to review prototypes in a timely manner

Software Engineering Process - II 3.8 Risk Categories  There are three categories of risks:  Project risks: Risks that affect the project schedule or resources. For example, unavailability of a particular skill.  Product risks: Risks that affect the quality or performance of the software. For example, integration problem of a CASE tool, poor run time performance.  Business risks: Risks that affect the organization developing the software. For example, introduction of a competitive product.

Software Engineering Process - II 3.9 Class Activity - 1  Make a list of three possible risks in each category – project, product, and business.

Software Engineering Process - II 3.10 Issues Impacting Risk Management

Software Engineering Process - II 3.11 Risk Identification  Risk identification involves discovering possible risks through:  Brainstorming  Experience  Consulting a checklist of possible risks  Schedule  Cost  Quality  Requirements  Operation

Software Engineering Process - II 3.12 Identifying Risks

Software Engineering Process - II 3.13 Identifying Schedule Risks  Schedule risks can be identified by:  Evaluating the likely range of the values for the completion date of critical dates of the project schedule.  Analyzing the nodes of project activity network for a high degree of fan-in and fan-out as these are high risk areas.  Analyzing the activities lying on the critical path.

Software Engineering Process - II 3.14 Identifying Cost Risks  Cost risks can be identified by:  Using parametric models to judge the effect of a change in system characteristic or addition/modification of a requirement.  Examining project dependencies.  Creating risk hierarchy from the project WBS.

Software Engineering Process - II 3.15 Identifying Cost Risks (cont.)  Factors that influence cost and schedule risks are:  Uncertain requirements  Faulty estimates  Creeping requirements  Schedule compression  Unreasonable budgets

Software Engineering Process - II 3.16 Identifying Requirement Risks  Risks may result from requirements that are:  Incorrect  Incomplete  Inconsistent  Complex  Infeasible  Nonverifiable  Untraceable  Volatile

Software Engineering Process - II 3.17 Identifying Quality Risks  Quality risks can result if the developed software is:  Nonreliable  Nonusable  Nonmaintainable  Nonportable  Nonexpandable

Software Engineering Process - II 3.18 Identifying Operational Risks  Operational risks result from a product that does not meet operational needs.  Some examples are:  Unreliable product requires unplanned support  Sensitive installation or improper documentation  Help function does not match with manual help process  Updating a home product requires a high speed network connection

Software Engineering Process - II 3.19 Risk Analysis  Risk analysis involves:  Determining the probability of occurrence of each risk, for example < 25%, 50%–60%.  Identifying the consequence in case a risk occurs.  Documenting the result in a risk registry which should be updated at regular intervals.

Software Engineering Process - II 3.20 Class Activity - 2  Design a template for maintaining a risk registry.

Software Engineering Process - II 3.21 Risk Treatment  Risk treatment consists of the following techniques to reduce the probability and impact of risks:  Risk avoidance: Selecting a lower risk approach  Risk acceptance: Accepting the consequences if the risk occurs  Risk control: Devising methods to reduce the effect  Risk transfer: Transferring potential problem to other areas of responsibility  Knowledge acquisition: Using acquired knowledge to refine assessment of risk

Software Engineering Process - II 3.22 Risk Treatment (cont.) RisksAvoidanceAcceptanceControlTransferKnowledge Refinement Vehicle and/or occupant injury in an auto accident while driving to work  Live close to work and walk  Ride rapid-transit systems Drive to work and hope for the best  Reduce speed limits  Wear seatbelts  Strengthen side panels  Go with a safe driver  Carry auto insurance  Operate good emergency medical systems  Sue other driver  Determine safest automobiles through crash tests  Determine safest route to work

Software Engineering Process - II 3.23 Just a Minute  You are going for your first job interview and there is a risk of reaching late. Can you think of some risk treatment methods?

Software Engineering Process - II 3.24 Estimating Risk Impacts  Cost effectiveness of risk management can be calculated as follows: 1. Determine the probability of a risk 2. Compute the cost of loss if risk becomes a problem 3. Calculate Risk Exposure = (Probability of loss)* (Amount of loss)

Software Engineering Process - II 3.25 Estimating Risk Impacts  You can compare the risk exposure before and after the risk management technique is applied.  A metric that compares is called Risk Leverage (RL) which is:  RE before mitigation – RE after mitigation/Cost of mitigation  Higher risk leverage indicates an area for investing in risk management.

Software Engineering Process - II 3.26 Monitoring Risks  Monitoring inactive risks so that prompt action can be taken if they become inactive  Selecting risk indicators and thresholds  Reviewing the status of active risks  Revaluating inactive risk mitigation plans to verify their appropriateness  Considering key risks during management reviews

Software Engineering Process - II 3.27 Risk Management Plan  The risk management plan should contain the following for each identified risk:  Statement of risk factor  Risk probability  Estimated consequences  Assumptions that impact the risk  Alternatives, if any  Risk reduction/mitigation method  Responsibility

Software Engineering Process - II 3.28 Summary  What was your key learning from the unit?